openplanr 2.2640.8 → 2.2641.0

package/lib/host-packages/cursor/openplanr/runtime/design/scripts/design-encrypted-workspace-client.mjs

@@ -0,0 +1,647 @@
+import {
+  canonicalizeJson,
+  sha256Hex
+} from "./design-shared-protocol-contracts-75a938cc.mjs";
+
+// packages/artifact/lib/artifact/internal/workspace-address.mjs
+function createWorkspaceAddress({
+  label,
+  reviewPath,
+  defaultBaseUrl = "https://share.openplanr.dev"
+}) {
+  function normalizeWorkspaceBase(baseUrl = defaultBaseUrl) {
+    const url = new URL(baseUrl);
+    if (url.username || url.password || url.search || url.hash || url.pathname !== "/" || url.protocol !== "https:" && !(url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)))
+      throw new TypeError(
+        `${label} sharing requires an HTTPS origin or a local development server.`
+      );
+    return url.origin;
+  }
+  function workspaceReviewUrl(access) {
+    if (!/^[A-Za-z0-9_-]{22,64}$/.test(access.id))
+      throw new TypeError(`Invalid ${label.toLowerCase()} workspace identity.`);
+    return `${normalizeWorkspaceBase(access.baseUrl)}${reviewPath}/${access.id}`;
+  }
+  return { normalizeWorkspaceBase, workspaceReviewUrl };
+}
+
+// packages/artifact/lib/artifact/encrypted-workspace-client.mjs
+function createEncryptedWorkspaceClient({
+  domain,
+  apiPath,
+  reviewPath,
+  label,
+  compatibilityMessage,
+  compatibilityCode = "E_WORKSPACE_UNSUPPORTED",
+  defaultBaseUrl = "https://share.openplanr.dev",
+  version = "1.0.0",
+  maxBytes = 5 * 1024 * 1024,
+  maxEventBytes = 256 * 1024,
+  schemas,
+  assertContract,
+  assertBundle,
+  assertFeedback,
+  bundleDigest,
+  digestInput = (bundle) => bundle,
+  packBundle = async (bundle) => bundle,
+  unpackBundle = async (bundle) => bundle
+}) {
+  if (!domain || !apiPath?.startsWith("/") || !reviewPath?.startsWith("/") || !label)
+    throw new TypeError("An encrypted workspace requires an explicit domain and routes.");
+  const encoder = new TextEncoder();
+  const decoder = new TextDecoder("utf-8", { fatal: true });
+  const tokenPattern = /^[A-Za-z0-9_-]{43}$/;
+  const idPattern = /^[A-Za-z0-9_-]{22,64}$/;
+  const ec = { name: "ECDSA", namedCurve: "P-256" };
+  const signatureAlgorithm = { name: "ECDSA", hash: "SHA-256" };
+  const omitSignature = ({ signature: _signature, ...value }) => value;
+  const operationError = (message, code, status) => Object.assign(new Error(message), { code, ...status ? { status } : {} });
+  function encodeWorkspaceBytes(bytes) {
+    let binary = "";
+    for (let offset = 0; offset < bytes.length; offset += 8192)
+      binary += String.fromCharCode(...bytes.subarray(offset, offset + 8192));
+    return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
+  }
+  function decodeWorkspaceBytes(value) {
+    if (typeof value !== "string" || !/^[A-Za-z0-9_-]+$/u.test(value))
+      throw new TypeError("Invalid encoded workspace value.");
+    const decoded = Uint8Array.from(
+      atob(value.replaceAll("-", "+").replaceAll("_", "/")),
+      (char) => char.charCodeAt(0)
+    );
+    if (encodeWorkspaceBytes(decoded) !== value)
+      throw new TypeError("Noncanonical encoded workspace value.");
+    return decoded;
+  }
+  function newWorkspaceToken() {
+    return encodeWorkspaceBytes(crypto.getRandomValues(new Uint8Array(32)));
+  }
+  function newWorkspaceId() {
+    return encodeWorkspaceBytes(crypto.getRandomValues(new Uint8Array(18)));
+  }
+  const { normalizeWorkspaceBase, workspaceReviewUrl } = createWorkspaceAddress({
+    label,
+    reviewPath,
+    defaultBaseUrl
+  });
+  async function tokenMaterial(token, id, purpose) {
+    if (!tokenPattern.test(token) || decodeWorkspaceBytes(token).length !== 32 || !idPattern.test(id))
+      throw new TypeError("Enter the complete generated access token.");
+    const key = await crypto.subtle.importKey("raw", decodeWorkspaceBytes(token), "HKDF", false, [
+      "deriveBits"
+    ]);
+    return new Uint8Array(
+      await crypto.subtle.deriveBits(
+        {
+          name: "HKDF",
+          hash: "SHA-256",
+          salt: encoder.encode(id),
+          info: encoder.encode(`${domain}/${purpose}`)
+        },
+        key,
+        256
+      )
+    );
+  }
+  async function deriveWorkspaceAuthentication(token, id) {
+    return encodeWorkspaceBytes(await tokenMaterial(token, id, "reviewer-auth"));
+  }
+  function canonicalWorkspacePublicKey(value) {
+    if (value?.kty !== "EC" || value.crv !== "P-256" || !tokenPattern.test(value.x ?? "") || !tokenPattern.test(value.y ?? "") || "d" in value) {
+      throw new TypeError(`Invalid ${label.toLowerCase()} workspace public key.`);
+    }
+    return { kty: "EC", crv: "P-256", x: value.x, y: value.y };
+  }
+  async function createWorkspaceSigner() {
+    const pair = await crypto.subtle.generateKey(ec, true, ["sign", "verify"]);
+    return {
+      privateKey: encodeWorkspaceBytes(
+        new Uint8Array(await crypto.subtle.exportKey("pkcs8", pair.privateKey))
+      ),
+      publicKey: canonicalWorkspacePublicKey(await crypto.subtle.exportKey("jwk", pair.publicKey))
+    };
+  }
+  async function signWorkspaceValue(value, privateKey) {
+    const key = await crypto.subtle.importKey(
+      "pkcs8",
+      decodeWorkspaceBytes(privateKey),
+      ec,
+      false,
+      ["sign"]
+    );
+    const signature = await crypto.subtle.sign(
+      signatureAlgorithm,
+      key,
+      encoder.encode(canonicalizeJson(omitSignature(value)))
+    );
+    return { ...omitSignature(value), signature: encodeWorkspaceBytes(new Uint8Array(signature)) };
+  }
+  async function verifyWorkspaceSignature(value, publicKey) {
+    try {
+      const key = await crypto.subtle.importKey("jwk", publicKey, ec, false, ["verify"]);
+      return await crypto.subtle.verify(
+        signatureAlgorithm,
+        key,
+        decodeWorkspaceBytes(value.signature),
+        encoder.encode(canonicalizeJson(omitSignature(value)))
+      );
+    } catch {
+      return false;
+    }
+  }
+  async function seal(value, rawKey, context, limit = maxBytes) {
+    const bytes = encoder.encode(canonicalizeJson(value));
+    if (bytes.length + 16 > limit)
+      throw Object.assign(
+        new RangeError(
+          `Encrypted ${label.toLowerCase()} data exceeds the ${Math.floor(limit / 1024)} KB upload limit.`
+        ),
+        { code: "E_WORKSPACE_PAYLOAD_TOO_LARGE", status: 413 }
+      );
+    const key = await crypto.subtle.importKey("raw", rawKey, "AES-GCM", false, ["encrypt"]);
+    const iv = crypto.getRandomValues(new Uint8Array(12));
+    const ciphertext = await crypto.subtle.encrypt(
+      { name: "AES-GCM", iv, additionalData: encoder.encode(canonicalizeJson(context)) },
+      key,
+      bytes
+    );
+    return {
+      iv: encodeWorkspaceBytes(iv),
+      ciphertext: encodeWorkspaceBytes(new Uint8Array(ciphertext))
+    };
+  }
+  async function unseal(value, rawKey, context, limit = maxBytes) {
+    const bytes = decodeWorkspaceBytes(value.ciphertext);
+    if (bytes.length > limit)
+      throw new RangeError(`Shared ${label.toLowerCase()} data exceeds its size limit.`);
+    const key = await crypto.subtle.importKey("raw", rawKey, "AES-GCM", false, ["decrypt"]);
+    const plaintext = await crypto.subtle.decrypt(
+      {
+        name: "AES-GCM",
+        iv: decodeWorkspaceBytes(value.iv),
+        additionalData: encoder.encode(canonicalizeJson(context))
+      },
+      key,
+      bytes
+    );
+    return JSON.parse(decoder.decode(plaintext));
+  }
+  const keyringContext = (id, epoch) => ({ type: "keyring", workspaceId: id, epoch });
+  const revisionContext = (id, revision) => ({
+    type: "revision",
+    workspaceId: id,
+    id: revision.id,
+    epoch: revision.epoch,
+    reviewOf: revision.reviewOf
+  });
+  const eventContext = (id, event) => ({
+    type: "event",
+    workspaceId: id,
+    id: event.id,
+    epoch: event.epoch,
+    revisionId: event.revisionId,
+    reviewOf: event.reviewOf
+  });
+  function workspaceEnvelopeDigest(value) {
+    return bundleDigest(value);
+  }
+  async function wrapKeyring(custody, token = custody.token, epoch = custody.epoch, keys = custody.keys) {
+    return seal(
+      { keys, ownerPublicKey: custody.ownerPublicKey },
+      await tokenMaterial(token, custody.id, "key-wrap"),
+      keyringContext(custody.id, epoch)
+    );
+  }
+  async function prepareRevision(custody, bundle) {
+    assertBundle(bundle);
+    const header = {
+      id: newWorkspaceId(),
+      epoch: custody.epoch,
+      reviewOf: workspaceEnvelopeDigest(digestInput(bundle)),
+      createdAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    return signWorkspaceValue(
+      {
+        ...header,
+        ...await seal(
+          await packBundle(bundle),
+          decodeWorkspaceBytes(custody.keys[custody.epoch]),
+          revisionContext(custody.id, header)
+        )
+      },
+      custody.ownerPrivateKey
+    );
+  }
+  async function prepareWorkspace(bundle, { baseUrl = defaultBaseUrl } = {}) {
+    const signer = await createWorkspaceSigner();
+    const custody = {
+      schemaVersion: version,
+      id: newWorkspaceId(),
+      baseUrl: normalizeWorkspaceBase(baseUrl),
+      token: newWorkspaceToken(),
+      ownerAuth: newWorkspaceToken(),
+      ownerPrivateKey: signer.privateKey,
+      ownerPublicKey: signer.publicKey,
+      epoch: 1,
+      keys: { 1: newWorkspaceToken() },
+      version: 0
+    };
+    custody.keyring = await wrapKeyring(custody);
+    custody.pendingCreate = await signWorkspaceValue(
+      {
+        schemaVersion: version,
+        id: custody.id,
+        ownerPublicKey: custody.ownerPublicKey,
+        ownerAuthHash: sha256Hex(custody.ownerAuth),
+        reviewerAuthHash: sha256Hex(await deriveWorkspaceAuthentication(custody.token, custody.id)),
+        epoch: 1,
+        keyring: custody.keyring,
+        revision: await prepareRevision(custody, bundle),
+        operationId: newWorkspaceId()
+      },
+      custody.ownerPrivateKey
+    );
+    assertContract(custody.pendingCreate, schemas.create);
+    return custody;
+  }
+  async function request(access, suffix = "", {
+    method = "GET",
+    body,
+    fetchImpl = globalThis.fetch,
+    owner = Boolean(access.ownerAuth),
+    timeoutMs = 2e4
+  } = {}) {
+    if (!idPattern.test(access.id))
+      throw new TypeError(`Invalid ${label.toLowerCase()} workspace identity.`);
+    const authorization = owner ? access.ownerAuth : await deriveWorkspaceAuthentication(access.token, access.id);
+    const headers = { Authorization: `Bearer ${authorization}`, Accept: "application/json" };
+    if (body) headers["Content-Type"] = "application/json";
+    let response;
+    try {
+      response = await fetchImpl(
+        `${normalizeWorkspaceBase(access.baseUrl)}${apiPath}/${access.id}${suffix}`,
+        {
+          method,
+          headers,
+          body: body ? JSON.stringify(body) : void 0,
+          redirect: "error",
+          cache: "no-store",
+          credentials: "omit",
+          signal: AbortSignal.timeout(timeoutMs)
+        }
+      );
+    } catch {
+      throw operationError(
+        `${label} sharing is unreachable. Check the connection and retry; the previous review is unchanged.`,
+        "E_WORKSPACE_NETWORK"
+      );
+    }
+    if (!response.ok) await throwResponseError(response, method);
+    return readResponse(response);
+  }
+  async function throwResponseError(response, method) {
+    if (response.status === 404 && method === "PUT" && compatibilityMessage) {
+      const error2 = new Error(compatibilityMessage);
+      error2.code = compatibilityCode;
+      error2.status = 404;
+      throw error2;
+    }
+    const messages = {
+      401: "Access token is incorrect or has been rotated.",
+      403: "This review is unavailable or this action requires its owner.",
+      404: "This shared review could not be found.",
+      409: "The shared review changed. Refresh its status before retrying.",
+      410: "This shared review has been revoked or deleted.",
+      413: `This ${label.toLowerCase()} exceeds the sharing upload limit.`,
+      429: "Too many requests. Wait a moment and retry.",
+      503: `${label} sharing is temporarily unavailable. Retry shortly.`
+    };
+    const error = new Error(
+      messages[response.status] ?? `${label} sharing failed (${response.status}). Retry shortly.`
+    );
+    error.status = response.status;
+    error.code = `E_WORKSPACE_HTTP_${response.status}`;
+    try {
+      const reader = response.body?.getReader();
+      const body = reader && JSON.parse(decoder.decode(await responseBytes(reader, 4096)));
+      if (typeof body?.error === "string" && /^[A-Za-z][A-Za-z0-9_-]{0,127}$/u.test(body.error))
+        error.code = body.error;
+    } catch {
+    }
+    if (response.status === 429) {
+      const header = response.headers.get("retry-after");
+      const seconds = header && /^\d+(?:\.\d+)?$/u.test(header.trim()) ? Number(header) : header ? (Date.parse(header) - Date.now()) / 1e3 : NaN;
+      if (Number.isFinite(seconds) && seconds >= 0)
+        error.retryAfterSeconds = Math.min(3600, Math.max(1, Math.ceil(seconds)));
+    }
+    throw error;
+  }
+  async function responseBytes(reader, limit) {
+    const chunks = [];
+    let length = 0;
+    try {
+      for (; ; ) {
+        const { value, done } = await reader.read();
+        if (done) break;
+        length += value.length;
+        if (length > limit) {
+          await reader.cancel();
+          throw new RangeError(`${label} service returned an oversized response.`);
+        }
+        chunks.push(value);
+      }
+    } catch (error) {
+      if (error instanceof RangeError) throw error;
+      throw new Error("The sharing response was interrupted. Retry the pending operation.");
+    }
+    const bytes = new Uint8Array(length);
+    let offset = 0;
+    for (const chunk of chunks) {
+      bytes.set(chunk, offset);
+      offset += chunk.length;
+    }
+    return bytes;
+  }
+  async function readResponse(response) {
+    if (response.status === 204) return {};
+    const reader = response.body?.getReader();
+    if (!reader) throw new Error(`${label} service returned an empty response.`);
+    try {
+      return JSON.parse(decoder.decode(await responseBytes(reader, maxBytes * 1.5 + 65536)));
+    } catch (cause) {
+      throw Object.assign(
+        operationError(
+          "The sharing response could not be verified. Retry the pending operation.",
+          "E_WORKSPACE_RESPONSE_INVALID"
+        ),
+        { cause }
+      );
+    }
+  }
+  async function commitWorkspace(custody, options = {}) {
+    if (!custody.pendingCreate) return getWorkspace(custody, options);
+    const result = await request(custody, "", {
+      ...options,
+      method: "PUT",
+      body: custody.pendingCreate
+    });
+    assertContract(result, schemas.workspace);
+    if (result.id !== custody.id || result.version !== 1 || result.epoch !== 1 || result.currentRevision !== custody.pendingCreate.revision.id || canonicalizeJson(result.ownerPublicKey) !== canonicalizeJson(custody.ownerPublicKey) || canonicalizeJson(result.keyring) !== canonicalizeJson(custody.keyring))
+      throw new Error("The sharing creation receipt is invalid. Retry the saved operation.");
+    custody.version = result.version;
+    custody.currentRevision = result.currentRevision;
+    delete custody.pendingCreate;
+    return result;
+  }
+  async function getWorkspace(access, options = {}) {
+    const result = assertContract(await request(access, "", options), schemas.workspace);
+    if (result.id !== access.id) throw new Error("Shared review identity mismatch.");
+    const ring = await unseal(
+      result.keyring,
+      await tokenMaterial(access.token, access.id, "key-wrap"),
+      keyringContext(access.id, result.epoch)
+    );
+    if (canonicalizeJson(ring.ownerPublicKey) !== canonicalizeJson(result.ownerPublicKey) || access.ownerPublicKey && canonicalizeJson(access.ownerPublicKey) !== canonicalizeJson(result.ownerPublicKey))
+      throw new Error("Shared review owner identity changed.");
+    if (!ring.keys?.[result.epoch] || Object.entries(ring.keys).some(
+      ([keyEpoch, key]) => !/^[1-9][0-9]*$/u.test(keyEpoch) || !tokenPattern.test(key)
+    ))
+      throw new Error("Invalid shared review key history.");
+    Object.assign(access, {
+      keys: ring.keys,
+      ownerPublicKey: result.ownerPublicKey,
+      epoch: result.epoch,
+      keyring: result.keyring,
+      version: result.version,
+      currentRevision: result.currentRevision,
+      commentsPaused: result.commentsPaused
+    });
+    return result;
+  }
+  async function listWorkspaceRevisions(access, { after = "", ...options } = {}) {
+    if (after && !idPattern.test(after)) throw new TypeError("Invalid revision cursor.");
+    return request(
+      access,
+      `/revisions${after ? `?after=${encodeURIComponent(after)}` : ""}`,
+      options
+    );
+  }
+  async function decryptWorkspaceRevision(access, revisionId = access.currentRevision, options = {}) {
+    if (!access.keys) await getWorkspace(access, options);
+    if (!idPattern.test(revisionId))
+      throw new TypeError(`Invalid ${label.toLowerCase()} revision.`);
+    const revision = assertContract(
+      await request(access, `/revisions/${revisionId}`, options),
+      schemas.revision
+    );
+    if (revision.id !== revisionId || !await verifyWorkspaceSignature(revision, access.ownerPublicKey))
+      throw new Error(`The published ${label.toLowerCase()} signature is invalid.`);
+    if (!access.keys[revision.epoch])
+      throw new Error("The access token cannot open this revision.");
+    const bundle = assertBundle(
+      await unpackBundle(
+        await unseal(
+          revision,
+          decodeWorkspaceBytes(access.keys[revision.epoch]),
+          revisionContext(access.id, revision)
+        )
+      )
+    );
+    if (workspaceEnvelopeDigest(digestInput(bundle)) !== revision.reviewOf)
+      throw new Error(`Published ${label.toLowerCase()} content does not match its revision.`);
+    return { ...bundle, workspaceRevision: revision.id, reviewOf: revision.reviewOf };
+  }
+  async function prepareWorkspaceMutation(custody, action, payload = void 0) {
+    if (custody.pendingCreate)
+      throw new Error("Finish creating this shared review before changing it.");
+    if (custody.pendingMutation)
+      throw new Error("A sharing operation is pending. Retry it before making another change.");
+    const body = {
+      operationId: newWorkspaceId(),
+      expectedVersion: custody.version,
+      epoch: custody.epoch
+    };
+    let next = {};
+    if (action === "publish") body.revision = await prepareRevision(custody, payload);
+    else if (action === "rotate") {
+      const token = newWorkspaceToken();
+      const epoch = custody.epoch + 1;
+      const keys = { ...custody.keys, [epoch]: newWorkspaceToken() };
+      const keyring = await wrapKeyring(custody, token, epoch, keys);
+      Object.assign(body, {
+        epoch,
+        reviewerAuthHash: sha256Hex(await deriveWorkspaceAuthentication(token, custody.id)),
+        keyring
+      });
+      next = { token, epoch, keys, keyring };
+    } else if (["pause", "resume", "revoke", "delete"].includes(action)) body.action = action;
+    else throw new TypeError(`Unknown ${label.toLowerCase()} sharing operation.`);
+    custody.pendingMutation = {
+      action,
+      body: await signWorkspaceValue(body, custody.ownerPrivateKey),
+      next
+    };
+    return custody.pendingMutation;
+  }
+  function assertDeletionReceipt(custody, result) {
+    if (result.schemaVersion !== version || result.id !== custody.id || result.deleted !== true || Object.keys(result).some((key) => !["schemaVersion", "id", "deleted"].includes(key)))
+      throw new Error("The deletion receipt is invalid. Retry the saved operation.");
+  }
+  function assertMutationReceipt(custody, pending, result) {
+    if (pending.action === "delete") return assertDeletionReceipt(custody, result);
+    assertContract(result, schemas.workspace);
+    const expectedRevision = pending.action === "publish" ? pending.body.revision.id : custody.currentRevision;
+    if (result.id !== custody.id || result.version !== pending.body.expectedVersion + 1 || result.epoch !== pending.body.epoch || result.currentRevision !== expectedRevision || canonicalizeJson(result.ownerPublicKey) !== canonicalizeJson(custody.ownerPublicKey) || canonicalizeJson(result.keyring) !== canonicalizeJson(pending.next.keyring ?? custody.keyring) || ["pause", "resume"].includes(pending.action) && result.commentsPaused !== (pending.action === "pause"))
+      throw new Error("The sharing operation receipt is invalid. Retry the saved operation.");
+  }
+  async function commitWorkspaceMutation(custody, options = {}) {
+    const pending = custody.pendingMutation;
+    if (!pending) throw new Error("No sharing operation is pending.");
+    const suffix = ["publish", "rotate"].includes(pending.action) ? pending.action : "manage";
+    const result = await request(custody, `/${suffix}`, {
+      ...options,
+      method: "POST",
+      body: pending.body
+    });
+    assertMutationReceipt(custody, pending, result);
+    Object.assign(custody, pending.next, { version: pending.body.expectedVersion + 1 });
+    if (pending.action === "publish") custody.currentRevision = pending.body.revision.id;
+    if (pending.action === "pause" || pending.action === "resume")
+      custody.commentsPaused = pending.action === "pause";
+    if (pending.action === "revoke" || pending.action === "delete")
+      custody.status = pending.action === "revoke" ? "revoked" : "deleted";
+    delete custody.pendingMutation;
+    return result;
+  }
+  async function publishWorkspace(custody, bundle, options = {}) {
+    await prepareWorkspaceMutation(custody, "publish", bundle);
+    return commitWorkspaceMutation(custody, options);
+  }
+  async function rotateWorkspace(custody, options = {}) {
+    await prepareWorkspaceMutation(custody, "rotate");
+    return commitWorkspaceMutation(custody, options);
+  }
+  async function manageWorkspace(custody, action, options = {}) {
+    await prepareWorkspaceMutation(custody, action);
+    return commitWorkspaceMutation(custody, options);
+  }
+  async function prepareWorkspaceEvent(access, payload, { revisionId = access.currentRevision, reviewOf = payload.reviewOf, signer } = {}) {
+    if (!access.keys) throw new Error("Unlock the shared review before commenting.");
+    assertFeedback(payload);
+    const identity = signer ?? await createWorkspaceSigner();
+    const publicKey = canonicalWorkspacePublicKey(identity.publicKey);
+    const header = { id: newWorkspaceId(), revisionId, reviewOf, epoch: access.epoch };
+    const event = await signWorkspaceValue(
+      {
+        ...header,
+        ...await seal(
+          payload,
+          decodeWorkspaceBytes(access.keys[access.epoch]),
+          eventContext(access.id, header),
+          maxEventBytes
+        ),
+        publicKey
+      },
+      identity.privateKey
+    );
+    return assertContract(event, schemas.event);
+  }
+  async function appendWorkspaceEvent(access, payload, { preparedEvent, signer, revisionId, reviewOf, ...options } = {}) {
+    const event = preparedEvent ?? await prepareWorkspaceEvent(access, payload, {
+      signer,
+      revisionId,
+      reviewOf: reviewOf ?? payload.reviewOf
+    });
+    const result = await request(access, "/events", { ...options, method: "POST", body: event });
+    if (!result || typeof result !== "object" || Array.isArray(result) || !Number.isSafeInteger(result.sequence) || result.sequence < 1 || !result.event || typeof result.event !== "object" || Array.isArray(result.event))
+      throw new Error("The feedback receipt is invalid. Retry the saved operation.");
+    const { sequence: eventSequence, ...received } = result.event;
+    if (eventSequence !== void 0 && eventSequence !== result.sequence || canonicalizeJson(received) !== canonicalizeJson(event))
+      throw new Error(
+        "The feedback receipt does not match the saved event. Retry the saved operation."
+      );
+    return { event: { ...received, sequence: result.sequence }, sequence: result.sequence };
+  }
+  function assertEventPage(page, after) {
+    if (!Array.isArray(page.events) || page.events.length > 100 || !Number.isSafeInteger(page.cursor) || page.cursor < after || typeof page.hasMore !== "boolean")
+      throw new Error("Invalid shared feedback page.");
+  }
+  async function decryptEvent(access, record, sequence) {
+    assertContract(record, schemas.event);
+    if (!await verifyWorkspaceSignature(record, record.publicKey))
+      throw new Error("Signature verification failed.");
+    if (!access.keys[record.epoch]) throw new Error("The encryption epoch is unavailable.");
+    const payload = await unseal(
+      record,
+      decodeWorkspaceBytes(access.keys[record.epoch]),
+      eventContext(access.id, record),
+      maxEventBytes
+    );
+    assertFeedback(payload);
+    if (payload.reviewOf !== record.reviewOf) throw new Error("Feedback revision is invalid.");
+    return { ...record, sequence, payload };
+  }
+  function eventFromPage(item, pageIds, previousSequence, cursor) {
+    const { sequence, ...record } = item?.event ? { ...item.event, sequence: item.sequence } : item ?? {};
+    if (!Number.isSafeInteger(sequence) || sequence <= previousSequence || sequence > cursor)
+      throw new Error("Invalid shared feedback sequence.");
+    if (typeof record.id !== "string" || pageIds.has(record.id))
+      throw new Error("Invalid shared feedback event identity.");
+    pageIds.add(record.id);
+    return { sequence, record };
+  }
+  async function readWorkspaceEvents(access, { after = 0, ...options } = {}) {
+    if (!Number.isSafeInteger(after) || after < 0) throw new TypeError("Invalid feedback cursor.");
+    if (!access.keys) await getWorkspace(access, options);
+    const page = await request(access, `/events?after=${after}`, options);
+    assertEventPage(page, after);
+    const events = [], issues = [], pageIds = /* @__PURE__ */ new Set();
+    let previousSequence = after;
+    for (const item of page.events) {
+      const { sequence, record } = eventFromPage(item, pageIds, previousSequence, page.cursor);
+      previousSequence = sequence;
+      try {
+        events.push(await decryptEvent(access, record, sequence));
+      } catch {
+        issues.push({
+          sequence,
+          id: typeof record.id === "string" && idPattern.test(record.id) ? record.id : null,
+          reason: "Invalid encrypted feedback; not imported."
+        });
+      }
+    }
+    return { ...page, events, issues };
+  }
+  return {
+    encodeWorkspaceBytes,
+    decodeWorkspaceBytes,
+    newWorkspaceToken,
+    newWorkspaceId,
+    normalizeWorkspaceBase,
+    workspaceReviewUrl,
+    deriveWorkspaceAuthentication,
+    canonicalWorkspacePublicKey,
+    createWorkspaceSigner,
+    signWorkspaceValue,
+    verifyWorkspaceSignature,
+    workspaceEnvelopeDigest,
+    prepareWorkspace,
+    commitWorkspace,
+    getWorkspace,
+    listWorkspaceRevisions,
+    decryptWorkspaceRevision,
+    prepareWorkspaceMutation,
+    commitWorkspaceMutation,
+    publishWorkspace,
+    rotateWorkspace,
+    manageWorkspace,
+    prepareWorkspaceEvent,
+    appendWorkspaceEvent,
+    readWorkspaceEvents
+  };
+}
+
+export {
+  createWorkspaceAddress,
+  createEncryptedWorkspaceClient
+};